CVE-2025-32966

CRITICAL

9.8

Description

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/23/2025

Last Modified6/24/2025

Sourcenvd

Honeypot Sightings0

Affected Products

dataease:dataease

Weaknesses (CWE)

CWE-290

References

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.